Generated by JEB on 2019/08/01

PE: C:\Windows\System32\oobe\audit.exe Base=0x140000000 SHA-256=1B17921ADC27FD0D29F5F1F02A333596FC25CCA27E2AE010F7B42FD8AC9EA80E
PDB: audit.pdb GUID={7710B33B-77B0-1423-1F889A32CC616482} Age=1

733 located named symbols:
0x14000D170: "In-use cached unattend file for " ??_C@_1HO@CMNEAEFO@?$AAI?$AAn?$AA?9?$AAu?$AAs?$AAe?$AA?5?$AAc?$AAa?$AAc?$AAh?$AAe?$AAd?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?5?$AAf?$AAo?$AAr?$AA?5@
0x140008B30: ParseUncPath
0x14000DC68: "ConstructPartialMsgVA" ??_C@_0BG@HIFPNDJH@ConstructPartialMsgVA?$AA@
0x14000B185: "__cdecl _tailMerge_ext_ms_win_ntuser_message_l1_1_0_dll" __tailMerge_ext_ms_win_ntuser_message_l1_1_0_dll
0x14000C578: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x14000ED60: "GetAdminAccountName: Couldn't fi" ??_C@_1IE@PEGDFDOB@?$AAG?$AAe?$AAt?$AAA?$AAd?$AAm?$AAi?$AAn?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAN?$AAa?$AAm?$AAe?$AA?3?$AA?5?$AAC?$AAo?$AAu?$AAl?$AAd?$AAn?$AA?8?$AAt?$AA?5?$AAf?$AAi@
0x14000E9A0: "1" ??_C@_13JGCMLPCH@?$AA1?$AA?$AA@
0x140008A24: BuildPathHr
0x140005BB8: AllocateString
0x1400102D0: "\\?\UNC" ??_C@_1BA@BFGBFLGI@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAU?$AAN?$AAC?$AA?$AA@
0x14000ABFC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x14000C350: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x1400117D8: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_shcore_obsolete_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_shcore_obsolete_l1_1_0_dll
0x14000DB50: "Parsing the command line failed." ??_C@_1GC@BAGBNEEC@?$AAP?$AAa?$AAr?$AAs?$AAi?$AAn?$AAg?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAc?$AAo?$AAm?$AAm?$AAa?$AAn?$AAd?$AA?5?$AAl?$AAi?$AAn?$AAe?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?4@
0x14000CA20: "api-ms-win-eventing-provider-l1-" ??_C@_1FA@IOGJNGGM@?$AAa?$AAp?$AAi?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAe?$AAv?$AAe?$AAn?$AAt?$AAi?$AAn?$AAg?$AA?9?$AAp?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?9?$AAl?$AA1?$AA?9@
0x14000D528: "%s /user" ??_C@_1BC@NLIHPMIO@?$AA?$CF?$AAs?$AA?5?$AA?1?$AAu?$AAs?$AAe?$AAr?$AA?$AA@
0x14000AA10: "__cdecl FindPESection" _FindPESection
0x14000C210: "__cdecl _imp_UnattendCtxDeserializeWithResults" __imp_UnattendCtxDeserializeWithResults
0x14000C2B8: "__cdecl _imp_CoInitializeEx" __imp_CoInitializeEx
0x14000A3D0: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x140011A5C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x140011920: ext-ms-win-rtcore-ntuser-sysparams-l1-1-0_NULL_THUNK_DATA_DLN
0x140011AAC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0
0x14000C770: samcli_NULL_THUNK_DATA
0x14000AA00: "__cdecl wsetargv" _wsetargv
0x140010150: "SOFTWARE\Microsoft\Windows NT\Cu" ??_C@_1HM@LMMFBDMI@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x14000D430: "Found no unattend file for %s pa" ??_C@_1GG@FILMFKCK@?$AAF?$AAo?$AAu?$AAn?$AAd?$AA?5?$AAn?$AAo?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AA?$CF?$AAs?$AA?5?$AAp?$AAa@
0x14000C1E8: "__cdecl _imp_ProcessActionQueue" __imp_ProcessActionQueue
0x1400140E0: "__cdecl _security_cookie_complement" __security_cookie_complement
0x140010560: "oobeldr.exe" ??_C@_1BI@POOEOIIM@?$AAo?$AAo?$AAb?$AAe?$AAl?$AAd?$AAr?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x14000C610: "__cdecl _imp__vscwprintf" __imp__vscwprintf
0x14000C698: "__cdecl _imp___wgetmainargs" __imp___wgetmainargs
0x1400103D0: Microsoft_Windows_Deplorch
0x14000FF20: "LoadSMISettings: failed to deser" ??_C@_1IM@MGNAHFGO@?$AAL?$AAo?$AAa?$AAd?$AAS?$AAM?$AAI?$AAS?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AA?3?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAd?$AAe?$AAs?$AAe?$AAr@
0x14000B0E8: "__cdecl _tailMerge_ext_ms_win_ntuser_keyboard_l1_1_0_dll" __tailMerge_ext_ms_win_ntuser_keyboard_l1_1_0_dll
0x14000E670: "%windir%\system32\cmd.exe" ??_C@_1DE@KLCKEDFP@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAm?$AAd?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x14000C1B8: "__cdecl tls_used" _tls_used
0x14000F4E0: "Password" ??_C@_1BC@LBMJCFCO@?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AA?$AA@
0x140014850: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbUkpvbrmhghUoryUlyquivUznwGEUhgwzucOlyq@pkeyinsts" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbUkpvbrmhghUoryUlyquivUznwGEUhgwzucOlyq@pkeyinsts
0x1400094C0: RegDeleteRecursive
0x14000C430: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x14000D130: "%windir%\panther\unattend.xml" ??_C@_1DM@INMBGCHH@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAp?$AAa?$AAn?$AAt?$AAh?$AAe?$AAr?$AA?2?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?4?$AAx?$AAm?$AAl?$AA?$AA@
0x14000E240: "Found existing file at [%s]; del" ??_C@_1FI@PIBMLMPG@?$AAF?$AAo?$AAu?$AAn?$AAd?$AA?5?$AAe?$AAx?$AAi?$AAs?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?5?$AAa?$AAt?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?$DL?$AA?5?$AAd?$AAe?$AAl@
0x14000A804: "__cdecl _CxxFrameHandler3" __CxxFrameHandler3
0x14000C5D8: "__cdecl _imp_LookupAccountSidW" __imp_LookupAccountSidW
0x14000C760: "__cdecl _imp_NetUserSetInfo" __imp_NetUserSetInfo
0x140007AC4: "long __cdecl CleanTempUnattendRegistrySpace(void)" ?CleanTempUnattendRegistrySpace@@YAJXZ
0x140006660: FileExists
0x1400039C4: "long __cdecl OrchestrateSetPassStatus(unsigned short const * __ptr64,enum _DEPLOYMENT_PASS_STATUS)" ?OrchestrateSetPassStatus@@YAJPEBGW4_DEPLOYMENT_PASS_STATUS@@@Z
0x14000B370: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x14000F660: "FindFirstFileNameW" ??_C@_0BD@OGFDEFBL@FindFirstFileNameW?$AA@
0x14000DC08: "WdsGenericSetupLogInit" ??_C@_0BH@OICHNGNB@WdsGenericSetupLogInit?$AA@
0x14000603C: CopyResetFile
0x14000C340: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x14000F678: "FindNextFileNameW" ??_C@_0BC@MEIACHKG@FindNextFileNameW?$AA@
0x14000DA60: "audit.exe saw multiple instances" ??_C@_1HC@DPKJJDFK@?$AAa?$AAu?$AAd?$AAi?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?5?$AAs?$AAa?$AAw?$AA?5?$AAm?$AAu?$AAl?$AAt?$AAi?$AAp?$AAl?$AAe?$AA?5?$AAi?$AAn?$AAs?$AAt?$AAa?$AAn?$AAc?$AAe?$AAs@
0x1400110AC: "__cdecl Init_thread_epoch" _Init_thread_epoch
0x140011BEC: "__cdecl _IMPORT_DESCRIPTOR_OLEAUT32" __IMPORT_DESCRIPTOR_OLEAUT32
0x14000F4F8: "AdministratorPassword" ??_C@_1CM@NJGMPMPN@?$AAA?$AAd?$AAm?$AAi?$AAn?$AAi?$AAs?$AAt?$AAr?$AAa?$AAt?$AAo?$AAr?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AA?$AA@
0x140010898: "EtwEventEnabled" ??_C@_0BA@MIAFEPPA@EtwEventEnabled?$AA@
0x1400118F8: ext-ms-win-ntuser-keyboard-l1-1-0_NULL_THUNK_DATA_DLN
0x1400102E0: "CreatePath: Unable to create [%s" ??_C@_1FM@OFCLJDAE@?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAr?$AAe?$AAa?$AAt?$AAe?$AA?5?$AA?$FL?$AA?$CF?$AAs@
0x140016028: ext-ms-win-kernel32-localization-l1-1-0_NULL_THUNK_DATA_DLA
0x14000FC10: "An unattend GC requested that im" ??_C@_1MC@IGJAJBLM@?$AAA?$AAn?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAG?$AAC?$AA?5?$AAr?$AAe?$AAq?$AAu?$AAe?$AAs?$AAt?$AAe?$AAd?$AA?5?$AAt?$AAh?$AAa?$AAt?$AA?5?$AAi?$AAm@
0x14000E960: "DefaultUserName" ??_C@_1CA@CPAFHNCF@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAU?$AAs?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x140016010: "__cdecl _imp_CommandLineToArgvW" __imp_CommandLineToArgvW
0x140014128: "__cdecl commode" _commode
0x140010C68: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x14000C4B0: "__cdecl _imp_RegDeleteKeyExW" __imp_RegDeleteKeyExW
0x140011B74: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x140011A70: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0
0x14000E030: "Unable to delete existing file a" ??_C@_1EO@CHPEPMFA@?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAd?$AAe?$AAl?$AAe?$AAt?$AAe?$AA?5?$AAe?$AAx?$AAi?$AAs?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?5?$AAa@
0x140014840: g_WdsNativeLibLog
0x14000C3A0: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x14000DDD0: "System\Setup" ??_C@_1BK@DBNBIMPE@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x14000C628: "__cdecl _imp_wcschr" __imp_wcschr
0x14000C510: "__cdecl _imp_SetEvent" __imp_SetEvent
0x14000C4A8: "__cdecl _imp_RegFlushKey" __imp_RegFlushKey
0x14000F580: "%windir%\system32\oobe\winsetup." ??_C@_1EI@LCDEEIFL@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAo?$AAo?$AAb?$AAe?$AA?2?$AAw?$AAi?$AAn?$AAs?$AAe?$AAt?$AAu?$AAp?$AA?4@
0x14000DA40: "/system" ??_C@_1BA@BGNJFNA@?$AA?1?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?$AA@
0x14000A8E0: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x14000C780: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x14000CA70: "EventWrite" ??_C@_0L@JMEHOADM@EventWrite?$AA@
0x140011BD8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l2-1-0
0x140014134: "__cdecl fmode" _fmode
0x14000C500: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x14000C6E0: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x14000C3A8: "__cdecl _imp_GetModuleHandleExW" __imp_GetModuleHandleExW
0x14000F1D0: "ForceShutdownNow" ??_C@_1CC@IOIKADMG@?$AAF?$AAo?$AAr?$AAc?$AAe?$AAS?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AAN?$AAo?$AAw?$AA?$AA@
0x140001874: wWinMain
0x14000E860: "Unable to enable local account [" ??_C@_1FO@FLFMFMFO@?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAe?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAl?$AAo?$AAc?$AAa?$AAl?$AA?5?$AAa?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AA?5?$AA?$FL@
0x14000C5A8: api-ms-win-eventing-controller-l1-1-0_NULL_THUNK_DATA
0x1400117F8: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_kernel32_localization_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_kernel32_localization_l1_1_0_dll
0x14000D2A0: "Running %s pass with discovered " ??_C@_1GM@OODGAMDH@?$AAR?$AAu?$AAn?$AAn?$AAi?$AAn?$AAg?$AA?5?$AA?$CF?$AAs?$AA?5?$AAp?$AAa?$AAs?$AAs?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAd?$AAi?$AAs?$AAc?$AAo?$AAv?$AAe?$AAr?$AAe?$AAd?$AA?5@
0x1400110B0: "__cdecl tls_end" _tls_end
0x1400119F0: ext-ms-win-kernel32-localization-l1-1-0_NULL_THUNK_DATA_DLB
0x14000A93E: "__cdecl XcptFilter" _XcptFilter
0x14000C788: "__cdecl _xc_a" __xc_a
0x140011C14: "__cdecl _IMPORT_DESCRIPTOR_samcli" __IMPORT_DESCRIPTOR_samcli
0x14000C418: "__cdecl _imp_CreateProcessW" __imp_CreateProcessW
0x14000C9F8: "advapi32.dll" ??_C@_1BK@JHLNAEJL@?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x14000E658: "oobeSystem" ??_C@_1BG@HNJJNBMA@?$AAo?$AAo?$AAb?$AAe?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?$AA@
0x14000F618: "MessageBoxW" ??_C@_0M@DLDCCGNP@MessageBoxW?$AA@
0x14000F238: "<Reseal>" ??_C@_1BC@KHOGNNHF@?$AA?$DM?$AAR?$AAe?$AAs?$AAe?$AAa?$AAl?$AA?$DO?$AA?$AA@
0x14000F880: "DeleteFileEx: Unable to delete [" ??_C@_1GA@BJHEKIBJ@?$AAD?$AAe?$AAl?$AAe?$AAt?$AAe?$AAF?$AAi?$AAl?$AAe?$AAE?$AAx?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAd?$AAe?$AAl?$AAe?$AAt?$AAe?$AA?5?$AA?$FL@
0x140014748: PfnEventUnregister
0x14000C448: "__cdecl _imp_GetStartupInfoW" __imp_GetStartupInfoW
0x14000FEA0: "LoadSMISettings: failing on inva" ??_C@_1HE@ECPBNHJP@?$AAL?$AAo?$AAa?$AAd?$AAS?$AAM?$AAI?$AAS?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AA?3?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAi?$AAn?$AAg?$AA?5?$AAo?$AAn?$AA?5?$AAi?$AAn?$AAv?$AAa@
0x14000CC30: "%windir%\system32\oobe\windeploy" ??_C@_1EK@KHDPJMKJ@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAo?$AAo?$AAb?$AAe?$AA?2?$AAw?$AAi?$AAn?$AAd?$AAe?$AAp?$AAl?$AAo?$AAy@
0x140009464: RegSetExpand
0x14000C338: "__cdecl _imp_FindClose" __imp_FindClose
0x14000DE38: "OOBEInProgress" ??_C@_1BO@JHOBKEAA@?$AAO?$AAO?$AAB?$AAE?$AAI?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAe?$AAs?$AAs?$AA?$AA@
0x140014750: McGenPreVista
0x14000CB18: tskAuditProcessUnattendId
0x14000814C: StringCchCopyW
0x14000CC80: "Failed to set the thread executi" ??_C@_1HA@FNNNINCM@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAe?$AAt?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAt?$AAh?$AAr?$AAe?$AAa?$AAd?$AA?5?$AAe?$AAx?$AAe?$AAc?$AAu?$AAt?$AAi@
0x1400140C8: g_ProviderRegistrationMicrosoft_Windows_Deplorch
0x14000C608: api-ms-win-security-lsapolicy-l1-1-0_NULL_THUNK_DATA
0x14000C390: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x14000ADB7: "__cdecl lock" _lock
0x1400066FC: FlushFile
0x14000FE88: "%s\%s.%s" ??_C@_1BC@IFPDMNNO@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?4?$AA?$CF?$AAs?$AA?$AA@
0x14000CAB0: Microsoft_Windows_AuditLevels
0x14000C3F8: "__cdecl _imp_WritePrivateProfileStringW" __imp_WritePrivateProfileStringW
0x14000DD40: "onecore\base\ntsetup\lib\unatten" ??_C@_1HC@PLEDFMHN@?$AAo?$AAn?$AAe?$AAc?$AAo?$AAr?$AAe?$AA?2?$AAb?$AAa?$AAs?$AAe?$AA?2?$AAn?$AAt?$AAs?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAl?$AAi?$AAb?$AA?2?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn@
0x140010210: "ActionQueueCookie" ??_C@_1CE@NFDAPBBO@?$AAA?$AAc?$AAt?$AAi?$AAo?$AAn?$AAQ?$AAu?$AAe?$AAu?$AAe?$AAC?$AAo?$AAo?$AAk?$AAi?$AAe?$AA?$AA@
0x14000C868: "__cdecl _guard_iat_table" __guard_iat_table
0x14000C410: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x14000B336: memcpy
0x140008A80: FormFullPathName
0x14000C3D8: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x14000DAE0: "audit.exe must be called with ei" ??_C@_1GM@BDMGAGIE@?$AAa?$AAu?$AAd?$AAi?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?5?$AAm?$AAu?$AAs?$AAt?$AA?5?$AAb?$AAe?$AA?5?$AAc?$AAa?$AAl?$AAl?$AAe?$AAd?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAe?$AAi@
0x14000F1A0: "Audit" ??_C@_1M@KAILELML@?$AAA?$AAu?$AAd?$AAi?$AAt?$AA?$AA@
0x140014740: Microsoft_Windows_AuditEnableBits
0x14000C6B0: "__cdecl _imp_memset" __imp_memset
0x140011878: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_rtcore_ntuser_sysparams_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_rtcore_ntuser_sysparams_l1_1_0_dll
0x14000C518: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x14000C360: api-ms-win-core-file-l2-1-0_NULL_THUNK_DATA
0x14000ABCF: "__cdecl initterm" _initterm
0x14000E5D8: Microsoft_Windows_DeplorchKeywords
0x140011A84: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x1400148D8: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x14000F2F0: "unattend\settings[pass=%s]\compo" ??_C@_1OA@MDINPNNE@?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?2?$AAs?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AA?$FL?$AAp?$AAa?$AAs?$AAs?$AA?$DN?$AA?$CF?$AAs?$AA?$FN?$AA?2?$AAc?$AAo?$AAm?$AAp?$AAo@
0x14000C538: "__cdecl _imp_Sleep" __imp_Sleep
0x14000C7E0: "__cdecl _xi_z" __xi_z
0x140010858: "State" ??_C@_1M@LAGHHMEN@?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x14000C288: "__cdecl _imp_UnattendFreeResults" __imp_UnattendFreeResults
0x1400090FC: RegGetString
0x14000C2E8: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x14000C6F0: "__cdecl _imp_wcscmp" __imp_wcscmp
0x14000ABDB: "__cdecl _C_specific_handler" __C_specific_handler
0x140009320: RegSetDword
0x140006D74: "long __cdecl RunSMIDataPass(struct _UNATTEND_CONTEXT const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64 * __ptr64 * __ptr64,unsigned __int64 * __ptr64,struct _UNATTEND_PROCESSING_RESULTS * __ptr64)" ?RunSMIDataPass@@YAJPEBU_UNATTEND_CONTEXT@@PEBG1PEAPEAPEBGPEA_KPEAU_UNATTEND_PROCESSING_RESULTS@@@Z
0x14000C4F8: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x14000F1F8: "Microsoft-Windows-Deployment" ??_C@_1DK@CCIEOKPP@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?9?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?9?$AAD?$AAe?$AAp?$AAl?$AAo?$AAy?$AAm?$AAe?$AAn?$AAt?$AA?$AA@
0x14000CFD0: "Failed to restore the thread exe" ??_C@_1HA@KJHODDEC@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAr?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAt?$AAh?$AAr?$AAe?$AAa?$AAd?$AA?5?$AAe?$AAx?$AAe@
0x14000F810: "DeleteFileEx: Trying to set back" ??_C@_1GG@IIHDJFOG@?$AAD?$AAe?$AAl?$AAe?$AAt?$AAe?$AAF?$AAi?$AAl?$AAe?$AAE?$AAx?$AA?3?$AA?5?$AAT?$AAr?$AAy?$AAi?$AAn?$AAg?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAe?$AAt?$AA?5?$AAb?$AAa?$AAc?$AAk@
0x140010238: "smiengine.dll" ??_C@_1BM@EEHMEKOK@?$AAs?$AAm?$AAi?$AAe?$AAn?$AAg?$AAi?$AAn?$AAe?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x14000C690: "__cdecl _imp__onexit" __imp__onexit
0x14000C380: "__cdecl _imp_HeapFree" __imp_HeapFree
0x1400103C8: "\\" ??_C@_15LEKKCGMK@?$AA?2?$AA?2?$AA?$AA@
0x140003408: "long __cdecl OrchestrateBootCommand(unsigned short const * __ptr64,enum _SETUP_MODE)" ?OrchestrateBootCommand@@YAJPEBGW4_SETUP_MODE@@@Z
0x14000C1F0: ActionQueue_NULL_THUNK_DATA
0x1400030F0: UnattendInitializeLogEx2
0x14000C238: "__cdecl _imp_UnattendFindFileFromCmdLine" __imp_UnattendFindFileFromCmdLine
0x14000C370: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x140011858: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_ntuser_message_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_ntuser_message_l1_1_0_dll
0x14000C480: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x14000B2C8: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x14000FE80: "uaq" ??_C@_17GOEGKEGE@?$AAu?$AAa?$AAq?$AA?$AA@
0x14000DF50: "Updating pass status for [%s] to" ??_C@_1HO@NLEGFLEI@?$AAU?$AAp?$AAd?$AAa?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAp?$AAa?$AAs?$AAs?$AA?5?$AAs?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?5?$AAt?$AAo@
0x14000E5E0: Microsoft_Windows_DeplorchLevels
0x14000E1C0: "Source and destination paths are" ??_C@_1IA@GDOJDHMP@?$AAS?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AAa?$AAn?$AAd?$AA?5?$AAd?$AAe?$AAs?$AAt?$AAi?$AAn?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAp?$AAa?$AAt?$AAh?$AAs?$AA?5?$AAa?$AAr?$AAe@
0x14000EC40: "GetAdminAccountName: Local built" ??_C@_1HO@IDLANCIB@?$AAG?$AAe?$AAt?$AAA?$AAd?$AAm?$AAi?$AAn?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAN?$AAa?$AAm?$AAe?$AA?3?$AA?5?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?5?$AAb?$AAu?$AAi?$AAl?$AAt@
0x140011B4C: "__cdecl _IMPORT_DESCRIPTOR_ActionQueue" __IMPORT_DESCRIPTOR_ActionQueue
0x14000FCE0: "One or more unattend GCs request" ??_C@_1KC@NBNAOMPA@?$AAO?$AAn?$AAe?$AA?5?$AAo?$AAr?$AA?5?$AAm?$AAo?$AAr?$AAe?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAG?$AAC?$AAs?$AA?5?$AAr?$AAe?$AAq?$AAu?$AAe?$AAs?$AAt@
0x14000CAE8: AuditProcessUnattendUsingFile
0x1400146B0: "__cdecl _hmod__api_ms_win_shcore_obsolete_l1_1_0_dll" __hmod__api_ms_win_shcore_obsolete_l1_1_0_dll
0x14000D1F0: "We're in the middle of [%s], but" ??_C@_1KC@DGKIKEFO@?$AAW?$AAe?$AA?8?$AAr?$AAe?$AA?5?$AAi?$AAn?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAm?$AAi?$AAd?$AAd?$AAl?$AAe?$AA?5?$AAo?$AAf?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?0?$AA?5?$AAb?$AAu?$AAt@
0x14000D4B0: "No reboot" ??_C@_1BE@KAHHBIKI@?$AAN?$AAo?$AA?5?$AAr?$AAe?$AAb?$AAo?$AAo?$AAt?$AA?$AA@
0x14000DE08: "SystemSetupInProgress" ??_C@_1CM@DHJDDPJO@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAS?$AAe?$AAt?$AAu?$AAp?$AAI?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAe?$AAs?$AAs?$AA?$AA@
0x14000C720: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x14000C4D0: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x14000C728: "__cdecl _imp_NtSetThreadExecutionState" __imp_NtSetThreadExecutionState
0x14000CA90: "EventUnregister" ??_C@_0BA@FAKLIPIC@EventUnregister?$AA@
0x140011C50: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x14000C490: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x14000A9F3: "__cdecl amsg_exit" _amsg_exit
0x14000CB60: "Audit.exe launched with command-" ??_C@_1FK@GHGHPCJ@?$AAA?$AAu?$AAd?$AAi?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?5?$AAl?$AAa?$AAu?$AAn?$AAc?$AAh?$AAe?$AAd?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAc?$AAo?$AAm?$AAm?$AAa?$AAn?$AAd?$AA?9@
0x14000DCA8: "%windir%\Panther\UnattendGC" ??_C@_1DI@MEGHDGIK@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAP?$AAa?$AAn?$AAt?$AAh?$AAe?$AAr?$AA?2?$AAU?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AAG?$AAC?$AA?$AA@
0x1400102C0: "%s%s%s" ??_C@_1O@JBBHAGJJ@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$AA@
0x14000E2A0: "Couldn't delete existing file [%" ??_C@_1EG@GDOJHNHB@?$AAC?$AAo?$AAu?$AAl?$AAd?$AAn?$AA?8?$AAt?$AA?5?$AAd?$AAe?$AAl?$AAe?$AAt?$AAe?$AA?5?$AAe?$AAx?$AAi?$AAs?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?5?$AA?$FL?$AA?$CF@
0x14000C948: IID_IClassFactory
0x14000F050: "ScreenSaver:Successfully disable" ??_C@_1FO@MHKDFNNK@?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AAS?$AAa?$AAv?$AAe?$AAr?$AA?3?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAl?$AAy?$AA?5?$AAd?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe@
0x140009580: "long __cdecl OrchestrateUpdateImageState(struct HKEY__ * __ptr64,struct HKEY__ * __ptr64,unsigned short const * __ptr64)" ?OrchestrateUpdateImageState@@YAJPEAUHKEY__@@0PEBG@Z
0x140010C64: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x1400100A0: "SMI data results dump: Descripti" ??_C@_1FA@OGPLNFBO@?$AAS?$AAM?$AAI?$AA?5?$AAd?$AAa?$AAt?$AAa?$AA?5?$AAr?$AAe?$AAs?$AAu?$AAl?$AAt?$AAs?$AA?5?$AAd?$AAu?$AAm?$AAp?$AA?3?$AA?5?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAi@
0x14000C270: "__cdecl _imp_UnattendCtxReplaceMatchedNodesWithText" __imp_UnattendCtxReplaceMatchedNodesWithText
0x140004378: "long __cdecl DisableShiftF10(unsigned long)" ?DisableShiftF10@@YAJK@Z
0x140010620: "IMAGE_STATE_COMPLETE" ??_C@_1CK@FGKIFNPE@?$AAI?$AAM?$AAA?$AAG?$AAE?$AA_?$AAS?$AAT?$AAA?$AAT?$AAE?$AA_?$AAC?$AAO?$AAM?$AAP?$AAL?$AAE?$AAT?$AAE?$AA?$AA@
0x14000D620: "Arranging to be re-called after " ??_C@_1IA@IGMAPIKG@?$AAA?$AAr?$AAr?$AAa?$AAn?$AAg?$AAi?$AAn?$AAg?$AA?5?$AAt?$AAo?$AA?5?$AAb?$AAe?$AA?5?$AAr?$AAe?$AA?9?$AAc?$AAa?$AAl?$AAl?$AAe?$AAd?$AA?5?$AAa?$AAf?$AAt?$AAe?$AAr?$AA?5@
0x14000C670: "__cdecl _imp_exit" __imp_exit
0x14000B216: "__cdecl _imp_load_SystemParametersInfoW" __imp_load_SystemParametersInfoW
0x1400100F0: "SMI data results dump: Context d" ??_C@_1GA@PJGBJMFP@?$AAS?$AAM?$AAI?$AA?5?$AAd?$AAa?$AAt?$AAa?$AA?5?$AAr?$AAe?$AAs?$AAu?$AAl?$AAt?$AAs?$AA?5?$AAd?$AAu?$AAm?$AAp?$AA?3?$AA?5?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AA?5?$AAd@
0x14000C230: "__cdecl _imp_UnattendCtxOpenNode" __imp_UnattendCtxOpenNode
0x14000C660: "__cdecl _imp__lock" __imp__lock
0x14000C200: OLEAUT32_NULL_THUNK_DATA
0x14000C290: UNATTEND_NULL_THUNK_DATA
0x14000A8A4: atexit
0x14000C768: "__cdecl _imp_NetUserGetInfo" __imp_NetUserGetInfo
0x14000D848: "/shutdown" ??_C@_1BE@KKGMNDEN@?$AA?1?$AAs?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AA?$AA@
0x140010868: "EtwEventRegister" ??_C@_0BB@DHHHEAKO@EtwEventRegister?$AA@
0x14000F9C0: "Pass has failed status; system i" ??_C@_1GO@NLNOOFCF@?$AAP?$AAa?$AAs?$AAs?$AA?5?$AAh?$AAa?$AAs?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAs?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?$DL?$AA?5?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAi@
0x14000C2A8: "__cdecl _imp_CoUninitialize" __imp_CoUninitialize
0x14000B042: "__cdecl _imp_load_InitiateSystemShutdownExW" __imp_load_InitiateSystemShutdownExW
0x14000C5C8: "__cdecl _imp_GetSidLengthRequired" __imp_GetSidLengthRequired
0x14000C618: "__cdecl _imp__wcmdln" __imp__wcmdln
0x14000C4F0: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x14000AE74: IsNotifyUILanguageChangePresent
0x14000F5E8: "user32.dll" ??_C@_1BG@OILDLIOJ@?$AAu?$AAs?$AAe?$AAr?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x14000C4C0: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x14000DE68: "AuditBoot" ??_C@_1BE@OLOLOOKB@?$AAA?$AAu?$AAd?$AAi?$AAt?$AAB?$AAo?$AAo?$AAt?$AA?$AA@
0x14000C580: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x14000C250: "__cdecl _imp_UnattendFindAnswerFileWithResults" __imp_UnattendFindAnswerFileWithResults
0x14000C308: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x14000C568: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x140014848: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUhpforyUhixUlyquivUznwGEUhgwzucOlyq@skulib" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUhpforyUhixUlyquivUznwGEUhgwzucOlyq@skulib
0x14000C420: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x14000ADCF: "__cdecl _dllonexit" __dllonexit
0x14000B204: "__cdecl _imp_load_PostThreadMessageW" __imp_load_PostThreadMessageW
0x1400118C0: api-ms-win-core-shutdown-l1-1-0_NULL_THUNK_DATA_DLN
0x14000C248: "__cdecl _imp_UnattendCtxGetFlagByNode" __imp_UnattendCtxGetFlagByNode
0x14000EDF0: "ScreenSaver:Screen saver was ori" ??_C@_1JI@HBHOKNFD@?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AAS?$AAa?$AAv?$AAe?$AAr?$AA?3?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?5?$AAs?$AAa?$AAv?$AAe?$AAr?$AA?5?$AAw?$AAa?$AAs?$AA?5?$AAo?$AAr?$AAi@
0x14000C268: "__cdecl _imp_UnattendCtxCommitModify" __imp_UnattendCtxCommitModify
0x1400148B8: "__cdecl _native_startup_lock" __native_startup_lock
0x140016020: "__cdecl _imp_NotifyUILanguageChange" __imp_NotifyUILanguageChange
0x14000CB38: tskRunAuditId
0x140005F04: MsgBox
0x1400057A8: "long __cdecl ProcessResealSetting(unsigned short const * __ptr64,unsigned short const * __ptr64,struct _RESEAL_SETTING * __ptr64,struct _UNATTEND_PROCESSING_RESULTS * __ptr64)" ?ProcessResealSetting@@YAJPEBG0PEAU_RESEAL_SETTING@@PEAU_UNATTEND_PROCESSING_RESULTS@@@Z
0x14000A920: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x14000CB28: AuditProcessUnattendStopExecuted
0x140011BB0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x14000C680: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x1400068B0: "long __cdecl RunSMIPass(struct _UNATTEND_CONTEXT * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,int * __ptr64,struct _UNATTEND_PROCESSING_RESULTS * __ptr64)" ?RunSMIPass@@YAJPEAU_UNATTEND_CONTEXT@@PEBG11PEAHPEAU_UNATTEND_PROCESSING_RESULTS@@@Z
0x14000C638: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x14000D720: "Failed to set current boot as au" ??_C@_1GI@MJBCGAL@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAe?$AAt?$AA?5?$AAc?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AA?5?$AAb?$AAo?$AAo?$AAt?$AA?5?$AAa?$AAs?$AA?5?$AAa?$AAu@
0x14000E580: "Called script [%s] to handle fat" ??_C@_1FC@OFLHGABD@?$AAC?$AAa?$AAl?$AAl?$AAe?$AAd?$AA?5?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?5?$AAt?$AAo?$AA?5?$AAh?$AAa?$AAn?$AAd?$AAl?$AAe?$AA?5?$AAf?$AAa?$AAt@
0x14000C740: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x14000C3E0: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x14000C3F0: api-ms-win-core-libraryloader-l1-2-1_NULL_THUNK_DATA
0x1400146F8: "__cdecl _hmod__ext_ms_win_rtcore_ntuser_sysparams_l1_1_0_dll" __hmod__ext_ms_win_rtcore_ntuser_sysparams_l1_1_0_dll
0x14000C328: "__cdecl _imp_GetFileInformationByHandle" __imp_GetFileInformationByHandle
0x140014760: McGenTracingSupportInit
0x140002CE8: McTemplateMofU0q
0x14000C530: "__cdecl _imp_SleepConditionVariableSRW" __imp_SleepConditionVariableSRW
0x14000C300: "__cdecl _imp_GetLastError" __imp_GetLastError
0x14000B2A4: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x14000CDA0: "User input error was detected in" ??_C@_1HM@DIGNIGCF@?$AAU?$AAs?$AAe?$AAr?$AA?5?$AAi?$AAn?$AAp?$AAu?$AAt?$AA?5?$AAe?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAw?$AAa?$AAs?$AA?5?$AAd?$AAe?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AA?5?$AAi?$AAn@
0x1400146D8: "__cdecl tls_index" _tls_index
0x14000D7F8: "/oobe" ??_C@_1M@IOGMDJJD@?$AA?1?$AAo?$AAo?$AAb?$AAe?$AA?$AA@
0x140002E74: McGenEventTracingUnregister2
0x1400104C0: "IMAGE_STATE_GENERALIZE_RESEAL_TO" ??_C@_1EO@HOFCKBLH@?$AAI?$AAM?$AAA?$AAG?$AAE?$AA_?$AAS?$AAT?$AAA?$AAT?$AAE?$AA_?$AAG?$AAE?$AAN?$AAE?$AAR?$AAA?$AAL?$AAI?$AAZ?$AAE?$AA_?$AAR?$AAE?$AAS?$AAE?$AAA?$AAL?$AA_?$AAT?$AAO@
0x14000C6C8: "__cdecl _imp__commode" __imp__commode
0x14000DBB8: "auditUser" ??_C@_1BE@JLIBHMOF@?$AAa?$AAu?$AAd?$AAi?$AAt?$AAU?$AAs?$AAe?$AAr?$AA?$AA@
0x14000E430: "Specified unattend file [%s] doe" ??_C@_1FI@LMCDMCPJ@?$AAS?$AAp?$AAe?$AAc?$AAi?$AAf?$AAi?$AAe?$AAd?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?5?$AAd?$AAo?$AAe@
0x1400110A8: "__cdecl tls_start" _tls_start
0x14000C648: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x14000C710: "__cdecl _imp_RtlAdjustPrivilege" __imp_RtlAdjustPrivilege
0x14000C7F0: "__cdecl _xl_z" __xl_z
0x14000E768: "TempPrevBAState" ??_C@_1CA@GFJHDCJK@?$AAT?$AAe?$AAm?$AAp?$AAP?$AAr?$AAe?$AAv?$AAB?$AAA?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x1400118D0: api-ms-win-shcore-obsolete-l1-1-0_NULL_THUNK_DATA_DLN
0x14000DBE8: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x140011C8C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x14000C438: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x14000C508: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x140011C3C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l2-1-0
0x14000DF00: "System\Setup\Status\ChildComplet" ??_C@_1EI@CNNABGNJ@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?2?$AAC?$AAh?$AAi?$AAl?$AAd?$AAC?$AAo?$AAm?$AAp?$AAl?$AAe?$AAt@
0x14000CEB0: "Audit.exe is orchestrated a rebo" ??_C@_1HC@JKEAIALN@?$AAA?$AAu?$AAd?$AAi?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?5?$AAi?$AAs?$AA?5?$AAo?$AAr?$AAc?$AAh?$AAe?$AAs?$AAt?$AAr?$AAa?$AAt?$AAe?$AAd?$AA?5?$AAa?$AA?5?$AAr?$AAe?$AAb?$AAo@
0x14000A7B0: wWinMainCRTStartup
0x14000C488: "__cdecl _imp_RegDeleteValueW" __imp_RegDeleteValueW
0x140010C64: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x14000AAC0: "__cdecl ValidateImageBase" _ValidateImageBase
0x14000C5E8: "__cdecl _imp_LsaQueryInformationPolicy" __imp_LsaQueryInformationPolicy
0x14000CAA0: Microsoft_Windows_Audit
0x14000DBF8: "WdsSetupLogInit" ??_C@_0BA@EGFDPMGD@WdsSetupLogInit?$AA@
0x140016038: "__cdecl _imp_RegisterHotKey" __imp_RegisterHotKey
0x140008034: "long __cdecl StringCchCopyNW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,unsigned __int64)" ?StringCchCopyNW@@YAJPEAG_KPEBG1@Z
0x14000C718: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x14000C318: "__cdecl _imp_FlushFileBuffers" __imp_FlushFileBuffers
0x14000F7B0: "DeleteFileEx: hardlink given to " ??_C@_1FE@NMMDLJAB@?$AAD?$AAe?$AAl?$AAe?$AAt?$AAe?$AAF?$AAi?$AAl?$AAe?$AAE?$AAx?$AA?3?$AA?5?$AAh?$AAa?$AAr?$AAd?$AAl?$AAi?$AAn?$AAk?$AA?5?$AAg?$AAi?$AAv?$AAe?$AAn?$AA?5?$AAt?$AAo?$AA?5@
0x140011A98: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x140014898: "protected: static struct CEtwProviderT<void>::CETWApiSet CEtwProviderT<void>::g_etwApi" ?g_etwApi@?$CEtwProviderT@X@@1UCETWApiSet@1@A
0x14000F3D0: "unattend\settings[pass=%s]\compo" ??_C@_1NI@IDCHIAJK@?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?2?$AAs?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AA?$FL?$AAp?$AAa?$AAs?$AAs?$AA?$DN?$AA?$CF?$AAs?$AA?$FN?$AA?2?$AAc?$AAo?$AAm?$AAp?$AAo@
0x14000C9F0: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x1400146C0: "__cdecl _hmod__ext_ms_win_kernel32_localization_l1_1_0_dll" __hmod__ext_ms_win_kernel32_localization_l1_1_0_dll
0x14000E7E0: "Successfully enabled local accou" ??_C@_1HG@KNFKKHIB@?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAl?$AAy?$AA?5?$AAe?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?5?$AAl?$AAo?$AAc?$AAa?$AAl?$AA?5?$AAa?$AAc?$AAc?$AAo?$AAu@
0x14000C388: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x14000C3D0: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x14000C4C8: "__cdecl _imp_CompareStringW" __imp_CompareStringW
0x14000C4E0: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x140011898: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x140010BD0: IID_ISettingsEngine
0x14000C528: "__cdecl _imp_WakeAllConditionVariable" __imp_WakeAllConditionVariable
0x140014810: g_FindFirstFileName
0x140014130: "__cdecl newmode" _newmode
0x14000E9C8: "TempAutoLogonForSetup" ??_C@_1CM@GNBBMKNJ@?$AAT?$AAe?$AAm?$AAp?$AAA?$AAu?$AAt?$AAo?$AAL?$AAo?$AAg?$AAo?$AAn?$AAF?$AAo?$AAr?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x14000C5C0: "__cdecl _imp_GetSidSubAuthority" __imp_GetSidSubAuthority
0x1400140C0: g_ProviderRegistrationMicrosoft_Windows_Audit
0x14000C640: "__cdecl _imp__initterm" __imp__initterm
0x14000C678: "__cdecl _imp___set_app_type" __imp___set_app_type
0x14000C218: "__cdecl _imp_UnattendFreeNode" __imp_UnattendFreeNode
0x140010C48: "SYSTEM\Setup" ??_C@_1BK@BHBNHDAL@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x140005C90: AllocateExpand
0x14000F0B0: "ScreenSaver:Was unable to disabl" ??_C@_1FO@LINABPBP@?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AAS?$AAa?$AAv?$AAe?$AAr?$AA?3?$AAW?$AAa?$AAs?$AA?5?$AAu?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAd?$AAi?$AAs?$AAa?$AAb?$AAl@
0x1400146E0: "__cdecl _hmod__api_ms_win_core_shutdown_l1_1_0_dll" __hmod__api_ms_win_core_shutdown_l1_1_0_dll
0x140009414: RegSetString
0x14000ADE6: "__cdecl _imp_load_CommandLineToArgvW" __imp_load_CommandLineToArgvW
0x14000C2F8: "__cdecl _imp_SetLastError" __imp_SetLastError
0x14000D8A0: "%s %s" ??_C@_1M@MOFLFCEC@?$AA?$CF?$AAs?$AA?5?$AA?$CF?$AAs?$AA?$AA@
0x140011C78: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x140009254: RegGetDword
0x140003800: "long __cdecl OrchestrateIsAuditBootEx2(struct HKEY__ * __ptr64,int,int * __ptr64)" ?OrchestrateIsAuditBootEx2@@YAJPEAUHKEY__@@HPEAH@Z
0x14000C3C8: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x140010700: "SOFTWARE\Microsoft\Windows\Curre" ??_C@_1GM@FNOAOLDJ@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x140010820: "Setup\State" ??_C@_1BI@BOKHLGAB@?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x14000C920: "__cdecl _sz_api_ms_win_core_shutdown_l1_1_0_dll" __sz_api_ms_win_core_shutdown_l1_1_0_dll
0x14000C558: "__cdecl _imp_GetVersionExW" __imp_GetVersionExW
0x140011B9C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x1400059B8: "long __cdecl OrchestratePostProcessSettingsInCtx(struct _UNATTEND_CONTEXT const * __ptr64,unsigned short const * __ptr64)" ?OrchestratePostProcessSettingsInCtx@@YAJPEBU_UNATTEND_CONTEXT@@PEBG@Z
0x14000E080: "Unable to delete existing direct" ??_C@_1FC@JNNNOEBJ@?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAd?$AAe?$AAl?$AAe?$AAt?$AAe?$AA?5?$AAe?$AAx?$AAi?$AAs?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAd?$AAi?$AAr?$AAe?$AAc?$AAt@
0x140010050: "SMI data results dump: Source = " ??_C@_1EG@KGHBFICN@?$AAS?$AAM?$AAI?$AA?5?$AAd?$AAa?$AAt?$AAa?$AA?5?$AAr?$AAe?$AAs?$AAu?$AAl?$AAt?$AAs?$AA?5?$AAd?$AAu?$AAm?$AAp?$AA?3?$AA?5?$AAS?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AA?$DN?$AA?5@
0x14000A194: GetNameFromSID
0x140016050: "__cdecl _imp_GetMessageW" __imp_GetMessageW
0x1400148C8: "__cdecl _onexitend" __onexitend
0x14000C440: "__cdecl _imp_CreateThread" __imp_CreateThread
0x14000D808: "/audit" ??_C@_1O@IJCEODLF@?$AA?1?$AAa?$AAu?$AAd?$AAi?$AAt?$AA?$AA@
0x14000C658: "__cdecl _imp__exit" __imp__exit
0x14000ADC3: "__cdecl unlock" _unlock
0x140011C00: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-1" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-1
0x14000C778: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x14000C428: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x1400108C8: "enable" ??_C@_1O@DIHMNIPC@?$AAe?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x14000C708: netutils_NULL_THUNK_DATA
0x14000B04E: "__cdecl _tailMerge_api_ms_win_core_shutdown_l1_1_0_dll" __tailMerge_api_ms_win_core_shutdown_l1_1_0_dll
0x14000C738: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x140011818: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_core_shutdown_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_core_shutdown_l1_1_0_dll
0x140009D70: BuildPath
0x1400140F0: "__cdecl Init_global_epoch" _Init_global_epoch
0x14000C560: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x14000C7C8: "__cdecl _xi_a" __xi_a
0x140010BE0: CLSID_SettingsEngine
0x14000E0E0: "Caching copy of unattend file: [" ??_C@_1HE@PAAGAANL@?$AAC?$AAa?$AAc?$AAh?$AAi?$AAn?$AAg?$AA?5?$AAc?$AAo?$AAp?$AAy?$AA?5?$AAo?$AAf?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?3?$AA?5?$AA?$FL@
0x140014800: Microsoft_Windows_DeplorchEnableBits
0x14000C550: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x14000C2D8: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x14000AA00: "__cdecl matherr" _matherr
0x14000F110: "ScreenSaver:Screen saver was alr" ??_C@_1IK@BAGIJEGH@?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AAS?$AAa?$AAv?$AAe?$AAr?$AA?3?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?5?$AAs?$AAa?$AAv?$AAe?$AAr?$AA?5?$AAw?$AAa?$AAs?$AA?5?$AAa?$AAl?$AAr@
0x140007644: "long __cdecl UnattendResultsFromSMIDataResults(struct ISettingsResult * __ptr64 * __ptr64,unsigned __int64,unsigned short const * __ptr64,struct _UNATTEND_PROCESSING_RESULTS * __ptr64)" ?UnattendResultsFromSMIDataResults@@YAJPEAPEAUISettingsResult@@_KPEBGPEAU_UNATTEND_PROCESSING_RESULTS@@@Z
0x14000C620: "__cdecl _imp__unlock" __imp__unlock
0x14000DC50: "WdsSetupLogMessageW" ??_C@_0BE@PMAMNFBG@WdsSetupLogMessageW?$AA@
0x14000AED4: "__cdecl _tailMerge_ext_ms_win_kernel32_localization_l1_1_0_dll" __tailMerge_ext_ms_win_kernel32_localization_l1_1_0_dll
0x14000C5D0: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x14000DDB4: "D" ??_C@_13MKMNOPIJ@?$AAD?$AA?$AA@
0x14000A2F0: StopSetupETWSession
0x14000C2B0: "__cdecl _imp_CoTaskMemFree" __imp_CoTaskMemFree
0x14000FAA0: "Successfully applied data-only s" ??_C@_1GG@EGCHHDNH@?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAl?$AAy?$AA?5?$AAa?$AAp?$AAp?$AAl?$AAi?$AAe?$AAd?$AA?5?$AAd?$AAa?$AAt?$AAa?$AA?9?$AAo?$AAn?$AAl?$AAy?$AA?5?$AAs@
0x14000C260: "__cdecl _imp_UnattendCtxCancelModify" __imp_UnattendCtxCancelModify
0x14000C700: "__cdecl _imp_NetApiBufferFree" __imp_NetApiBufferFree
0x14000DCF8: "<unknown>" ??_C@_1BE@ELICABCK@?$AA?$DM?$AAu?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$DO?$AA?$AA@
0x140007448: "long __cdecl LoadSMISettings(struct ISettingsContext * __ptr64,struct ITargetInfo * __ptr64,struct IStream * __ptr64,unsigned short const * __ptr64,struct _UNATTEND_PROCESSING_RESULTS * __ptr64)" ?LoadSMISettings@@YAJPEAUISettingsContext@@PEAUITargetInfo@@PEAUIStream@@PEBGPEAU_UNATTEND_PROCESSING_RESULTS@@@Z
0x140010280: "%s" ??_C@_15GANGMFKL@?$AA?$CF?$AAs?$AA?$AA@
0x14000DC80: "ConstructPartialMsgVW" ??_C@_0BG@GEMHGGEA@ConstructPartialMsgVW?$AA@
0x140010448: "GeneralizationState" ??_C@_1CI@JDHNDED@?$AAG?$AAe?$AAn?$AAe?$AAr?$AAa?$AAl?$AAi?$AAz?$AAa?$AAt?$AAi?$AAo?$AAn?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x14000DBB4: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x140011B10: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x140003B54: "long __cdecl OrchestrateCacheUnattend(unsigned short const * __ptr64,unsigned short const * __ptr64)" ?OrchestrateCacheUnattend@@YAJPEBG0@Z
0x1400104A8: "setup.exe" ??_C@_1BE@PALHGNFE@?$AAs?$AAe?$AAt?$AAu?$AAp?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x14000B0DC: "__cdecl _imp_load_RegisterHotKey" __imp_load_RegisterHotKey
0x140016030: "__cdecl _imp_UnregisterHotKey" __imp_UnregisterHotKey
0x14000E710: "Unable to expand environmental v" ??_C@_1FI@OPMEDFNO@?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAe?$AAx?$AAp?$AAa?$AAn?$AAd?$AA?5?$AAe?$AAn?$AAv?$AAi?$AAr?$AAo?$AAn?$AAm?$AAe?$AAn?$AAt?$AAa?$AAl?$AA?5?$AAv@
0x14000C668: "__cdecl _imp___dllonexit" __imp___dllonexit
0x140016060: "__cdecl _imp_SystemParametersInfoW" __imp_SystemParametersInfoW
0x140010650: "OrchestrateUpdateImageState: Upd" ??_C@_1IK@OADGJKHF@?$AAO?$AAr?$AAc?$AAh?$AAe?$AAs?$AAt?$AAr?$AAa?$AAt?$AAe?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAI?$AAm?$AAa?$AAg?$AAe?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?3?$AA?5?$AAU?$AAp?$AAd@
0x140008610: PrepareUnicodePath
0x140011AC0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x14000C4D8: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x14000C6D0: "__cdecl _imp__vsnprintf" __imp__vsnprintf
0x14000C5F8: "__cdecl _imp_LsaFreeMemory" __imp_LsaFreeMemory
0x14000A7E0: "__cdecl _security_check_cookie" __security_check_cookie
0x14000DC98: "CurrentIP" ??_C@_09BJNIHBEK@CurrentIP?$AA@
0x14000C7C0: "__cdecl _xc_z" __xc_z
0x140011AE8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x14000C9C0: "__cdecl _sz_ext_ms_win_rtcore_ntuser_sysparams_l1_1_0_dll" __sz_ext_ms_win_rtcore_ntuser_sysparams_l1_1_0_dll
0x14000C460: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x14000F528: "ProductKey" ??_C@_1BG@DJPMEOGD@?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAK?$AAe?$AAy?$AA?$AA@
0x14000C3B0: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x140016018: api-ms-win-shcore-obsolete-l1-1-0_NULL_THUNK_DATA_DLA
0x14000E6B0: "%windir%\Setup\Scripts\disablecm" ??_C@_1FK@JILFMLLF@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAc?$AAr?$AAi?$AAp?$AAt?$AAs?$AA?2?$AAd?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAc?$AAm@
0x140011A00: api-ms-win-core-shutdown-l1-1-0_NULL_THUNK_DATA_DLB
0x14000D0E0: "%windir%\system32\sysprep\syspre" ??_C@_1EM@HFOKNOLP@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAs?$AAy?$AAs?$AAp?$AAr?$AAe?$AAp?$AA?2?$AAs?$AAy?$AAs?$AAp?$AAr?$AAe@
0x140014758: PfnEventWrite
0x140003868: "long __cdecl OrchestrateNextBootAsAudit(int)" ?OrchestrateNextBootAsAudit@@YAJH@Z
0x14000F8E0: "DeleteFileEx: Unable to clear ou" ??_C@_1IC@EOLNBKDF@?$AAD?$AAe?$AAl?$AAe?$AAt?$AAe?$AAF?$AAi?$AAl?$AAe?$AAE?$AAx?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAl?$AAe?$AAa?$AAr?$AA?5?$AAo?$AAu@
0x1400106E0: "ImageState" ??_C@_1BG@FKLEHGHC@?$AAI?$AAm?$AAa?$AAg?$AAe?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x14000C6A8: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140010270: "wcm://" ??_C@_1O@MAJFOJLL@?$AAw?$AAc?$AAm?$AA?3?$AA?1?$AA?1?$AA?$AA@
0x14000E980: "DefaultPassword" ??_C@_1CA@GEPNFAGB@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AA?$AA@
0x14000D498: "A reboot" ??_C@_1BC@KANCANKA@?$AAA?$AA?5?$AAr?$AAe?$AAb?$AAo?$AAo?$AAt?$AA?$AA@
0x14000F250: "ProcessResealSetting: Reseal mod" ??_C@_1JK@CENLPCJI@?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAR?$AAe?$AAs?$AAe?$AAa?$AAl?$AAS?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AA?3?$AA?5?$AAR?$AAe?$AAs?$AAe?$AAa?$AAl?$AA?5?$AAm?$AAo?$AAd@
0x140011C28: "__cdecl _IMPORT_DESCRIPTOR_netutils" __IMPORT_DESCRIPTOR_netutils
0x14000C548: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x14000D540: "Failed to notify UI language cha" ??_C@_1FO@PGGMGMHG@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAn?$AAo?$AAt?$AAi?$AAf?$AAy?$AA?5?$AAU?$AAI?$AA?5?$AAl?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AA?5?$AAc?$AAh?$AAa@
0x140016000: "__cdecl _imp_InitiateSystemShutdownExW" __imp_InitiateSystemShutdownExW
0x14000DCE0: "wdscore.dll" ??_C@_1BI@LOLJMEGL@?$AAw?$AAd?$AAs?$AAc?$AAo?$AAr?$AAe?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x14000C5E0: api-ms-win-security-lsalookup-l2-1-0_NULL_THUNK_DATA
0x14000C2C8: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x140010580: "IMAGE_STATE_SPECIALIZE_RESEAL_TO" ??_C@_1EO@CEOLAJON@?$AAI?$AAM?$AAA?$AAG?$AAE?$AA_?$AAS?$AAT?$AAA?$AAT?$AAE?$AA_?$AAS?$AAP?$AAE?$AAC?$AAI?$AAA?$AAL?$AAI?$AAZ?$AAE?$AA_?$AAR?$AAE?$AAS?$AAE?$AAA?$AAL?$AA_?$AAT?$AAO@
0x140010770: "%windir%" ??_C@_1BC@CGIBIBCK@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?$AA@
0x14000C378: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x140008298: StrAllocatingPrintf
0x140014838: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUwvkolixsUhixUlyquivUznwGEUkxsOlyq@DeplOrch" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUwvkolixsUhixUlyquivUznwGEUkxsOlyq@DeplOrch
0x14000B390: "__cdecl _chkstk" __chkstk
0x1400014B0: McGenEventTracingRegister
0x140014010: Microsoft_Windows_Audit_Context
0x1400067E4: "long __cdecl RunSMIPass(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,int * __ptr64,struct _UNATTEND_PROCESSING_RESULTS * __ptr64)" ?RunSMIPass@@YAJPEBG00PEAHPEAU_UNATTEND_PROCESSING_RESULTS@@@Z
0x140008838: CreatePath
0x14000C220: "__cdecl _imp_UnattendCtxSerialize" __imp_UnattendCtxSerialize
0x14000C960: "__cdecl _sz_ext_ms_win_ntuser_keyboard_l1_1_0_dll" __sz_ext_ms_win_ntuser_keyboard_l1_1_0_dll
0x14000DE58: "CmdLine" ??_C@_1BA@HBKFGLAC@?$AAC?$AAm?$AAd?$AAL?$AAi?$AAn?$AAe?$AA?$AA@
0x14000A088: RestoreLocalUserAccountState
0x14000E160: "Couldn't create destination dire" ??_C@_1FG@IBHDJDKC@?$AAC?$AAo?$AAu?$AAl?$AAd?$AAn?$AA?8?$AAt?$AA?5?$AAc?$AAr?$AAe?$AAa?$AAt?$AAe?$AA?5?$AAd?$AAe?$AAs?$AAt?$AAi?$AAn?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAd?$AAi?$AAr?$AAe@
0x14000E530: "%windir%\Setup\Scripts\ErrorHand" ??_C@_1FA@BDOGDKNC@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAc?$AAr?$AAi?$AAp?$AAt?$AAs?$AA?2?$AAE?$AAr?$AAr?$AAo?$AAr?$AAH?$AAa?$AAn?$AAd@
0x14000C320: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x140011B38: "__cdecl _IMPORT_DESCRIPTOR_UNATTEND" __IMPORT_DESCRIPTOR_UNATTEND
0x14000EF30: "ScreenSaver:Screen saver was ori" ??_C@_1IM@KBJHIGFF@?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AAS?$AAa?$AAv?$AAe?$AAr?$AA?3?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?5?$AAs?$AAa?$AAv?$AAe?$AAr?$AA?5?$AAw?$AAa?$AAs?$AA?5?$AAo?$AAr?$AAi@
0x1400119E0: api-ms-win-shcore-obsolete-l1-1-0_NULL_THUNK_DATA_DLB
0x140016008: api-ms-win-core-shutdown-l1-1-0_NULL_THUNK_DATA_DLA
0x14000C358: "__cdecl _imp_CopyFileExW" __imp_CopyFileExW
0x140011CA0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0
0x14000C470: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x14000C600: "__cdecl _imp_LsaClose" __imp_LsaClose
0x14000C7F8: "__cdecl _guard_fids_table" __guard_fids_table
0x140010470: "IMAGE_STATE_UNDEPLOYABLE" ??_C@_1DC@LJIKGBN@?$AAI?$AAM?$AAA?$AAG?$AAE?$AA_?$AAS?$AAT?$AAA?$AAT?$AAE?$AA_?$AAU?$AAN?$AAD?$AAE?$AAP?$AAL?$AAO?$AAY?$AAA?$AAB?$AAL?$AAE?$AA?$AA@
0x140005420: "long __cdecl OrchestrateShutdown(int)" ?OrchestrateShutdown@@YAJH@Z
0x14000C6F8: msvcrt_NULL_THUNK_DATA
0x14000D888: "%s %s %s" ??_C@_1BC@FAODPNIE@?$AA?$CF?$AAs?$AA?5?$AA?$CF?$AAs?$AA?5?$AA?$CF?$AAs?$AA?$AA@
0x14000C0B0: "__cdecl load_config_used" _load_config_used
0x14000E4E0: "System\Setup\Status\UnattendPass" ??_C@_1EG@BAEAMEDA@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?2?$AAU?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AAP?$AAa?$AAs?$AAs@
0x14000B222: "__cdecl _tailMerge_ext_ms_win_rtcore_ntuser_sysparams_l1_1_0_dll" __tailMerge_ext_ms_win_rtcore_ntuser_sysparams_l1_1_0_dll
0x1400073CC: "void __cdecl FreeSMISettingsInterfaces(struct ISettingsEngine * __ptr64,struct ISettingsContext * __ptr64,struct ITargetInfo * __ptr64,unsigned long)" ?FreeSMISettingsInterfaces@@YAXPEAUISettingsEngine@@PEAUISettingsContext@@PEAUITargetInfo@@K@Z
0x14000DC38: "WdsSetupLogMessageA" ??_C@_0BE@OAJEGAMB@WdsSetupLogMessageA?$AA@
0x140008EA4: RegSetBinEx
0x14000C280: "__cdecl _imp_UnattendCtxBeginModify" __imp_UnattendCtxBeginModify
0x14000EA20: "Successfully configured system f" ??_C@_1FK@KEHLHNCB@?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAl?$AAy?$AA?5?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAe?$AAd?$AA?5?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAf@
0x14000C2E0: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x14000C2D0: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x14000FFB0: "UnattendResultsFromSMIDataResult" ??_C@_1JC@MEMBMIDG@?$AAU?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AAR?$AAe?$AAs?$AAu?$AAl?$AAt?$AAs?$AAF?$AAr?$AAo?$AAm?$AAS?$AAM?$AAI?$AAD?$AAa?$AAt?$AAa?$AAR?$AAe?$AAs?$AAu?$AAl?$AAt@
0x14000EAF0: "IBS-BD60643B-2373-4f76-86F0-1539" ??_C@_1FC@PDBKODMH@?$AAI?$AAB?$AAS?$AA?9?$AAB?$AAD?$AA6?$AA0?$AA6?$AA4?$AA3?$AAB?$AA?9?$AA2?$AA3?$AA7?$AA3?$AA?9?$AA4?$AAf?$AA7?$AA6?$AA?9?$AA8?$AA6?$AAF?$AA0?$AA?9?$AA1?$AA5?$AA3?$AA9@
0x14000DDF0: "SetupPhase" ??_C@_1BG@OHENPCCM@?$AAS?$AAe?$AAt?$AAu?$AAp?$AAP?$AAh?$AAa?$AAs?$AAe?$AA?$AA@
0x140011BC4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x14000C278: "__cdecl _imp_UnattendAddResults" __imp_UnattendAddResults
0x14000EB50: "SOFTWARE\Microsoft\Windows\Curre" ??_C@_1GE@DONAIPPK@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x14000C6A0: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x14000D360: "Successfully completed RunSMIPas" ??_C@_1FE@FMMILLCA@?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAl?$AAy?$AA?5?$AAc?$AAo?$AAm?$AAp?$AAl?$AAe?$AAt?$AAe?$AAd?$AA?5?$AAR?$AAu?$AAn?$AAS?$AAM?$AAI?$AAP?$AAa?$AAs@
0x14000D990: "Parsing the following command li" ??_C@_1FC@BJMOHDJN@?$AAP?$AAa?$AAr?$AAs?$AAi?$AAn?$AAg?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAf?$AAo?$AAl?$AAl?$AAo?$AAw?$AAi?$AAn?$AAg?$AA?5?$AAc?$AAo?$AAm?$AAm?$AAa?$AAn?$AAd?$AA?5?$AAl?$AAi@
0x140009C44: StringCchCopyNExW
0x14000D040: "Audit.exe exiting with code [0x%" ??_C@_1EM@JGPHCGAE@?$AAA?$AAu?$AAd?$AAi?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?5?$AAe?$AAx?$AAi?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAc?$AAo?$AAd?$AAe?$AA?5?$AA?$FL?$AA0?$AAx?$AA?$CF@
0x140010970: "EnableLocalUserAccount: Unable t" ??_C@_1NM@IFFOPFH@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAL?$AAo?$AAc?$AAa?$AAl?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt@
0x14000C258: "__cdecl _imp_UnattendCtxSerializeSettingsStream" __imp_UnattendCtxSerializeSettingsStream
0x140002F10: "long __cdecl StringCchPrintfA(char * __ptr64,unsigned __int64,char const * __ptr64,...)" ?StringCchPrintfA@@YAJPEAD_KPEBDZZ
0x14000C3C0: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x1400080CC: "long __cdecl StringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCchPrintfW@@YAJPEAG_KPEBGZZ
0x140011838: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_ntuser_keyboard_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_ntuser_keyboard_l1_1_0_dll
0x14000C750: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x14000C8A0: "ext-ms-win-kernel32-localization" ??_C@_1FA@KDBGAOCJ@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAk?$AAe?$AAr?$AAn?$AAe?$AAl?$AA3?$AA2?$AA?9?$AAl?$AAo?$AAc?$AAa?$AAl?$AAi?$AAz?$AAa?$AAt?$AAi?$AAo?$AAn@
0x14000C468: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x14000F640: "kernel32.dll" ??_C@_1BK@MGMFAEKH@?$AAk?$AAe?$AAr?$AAn?$AAe?$AAl?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x14001412C: "__cdecl dowildcard" _dowildcard
0x14000ADF2: "__cdecl _tailMerge_api_ms_win_shcore_obsolete_l1_1_0_dll" __tailMerge_api_ms_win_shcore_obsolete_l1_1_0_dll
0x14000FA30: "Applying data-only settings over" ??_C@_1GG@DFIADDJD@?$AAA?$AAp?$AAp?$AAl?$AAy?$AAi?$AAn?$AAg?$AA?5?$AAd?$AAa?$AAt?$AAa?$AA?9?$AAo?$AAn?$AAl?$AAy?$AA?5?$AAs?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AA?5?$AAo?$AAv?$AAe?$AAr@
0x14000E600: "offlineServicing" ??_C@_1CC@OILJLBFF@?$AAo?$AAf?$AAf?$AAl?$AAi?$AAn?$AAe?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAi?$AAn?$AAg?$AA?$AA@
0x14000B0D0: ApiSetQueryApiSetPresence
0x14000C1E0: "__cdecl _imp_GenerateActionQueue" __imp_GenerateActionQueue
0x140014700: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUmghvgfkUlkpgllohUzfwrgUhixUlyquivUznwGEUkxsOlyq@audit" __@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUmghvgfkUlkpgllohUzfwrgUhixUlyquivUznwGEUkxsOlyq@audit
0x14000D090: "Status for unattend pass [%s] = " ??_C@_1EK@DNGMAGIL@?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAp?$AAa?$AAs?$AAs?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?5?$AA?$DN?$AA?5@
0x14000EBC0: "Successfully restored previous s" ??_C@_1HE@NMDFGAPG@?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAl?$AAy?$AA?5?$AAr?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AAd?$AA?5?$AAp?$AAr?$AAe?$AAv?$AAi?$AAo?$AAu?$AAs?$AA?5?$AAs@
0x14000C748: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140009F3C: EnableLocalUserAccount
0x14000C240: "__cdecl _imp_UnattendCtxGetEnumValueByNode" __imp_UnattendCtxGetEnumValueByNode
0x14000E490: "Error expanding Unattend dest pa" ??_C@_1FA@HECDHMKH@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAe?$AAx?$AAp?$AAa?$AAn?$AAd?$AAi?$AAn?$AAg?$AA?5?$AAU?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAd?$AAe?$AAs?$AAt?$AA?5?$AAp?$AAa@
0x14000F5C8: "UnattendErrorFromResults" ??_C@_0BJ@OICDMEKC@UnattendErrorFromResults?$AA@
0x14000DDB8: "SetupType" ??_C@_1BE@MMGHIOAH@?$AAS?$AAe?$AAt?$AAu?$AAp?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x140005D30: MsgBoxStr
0x140010C68: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x14000A8C4: "__cdecl _std_terminate" __std_terminate
0x140008034: StringCchCopyNW
0x140008FA4: RegExists
0x14000EA80: "Unable to configure system for a" ??_C@_1GI@LDDEBMEO@?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAe?$AA?5?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAa@
0x14000CBC0: "audit.exe" ??_C@_1BE@FNHKEEEF@?$AAa?$AAu?$AAd?$AAi?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x14000ABF0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x14000C408: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x14000DD18: "UnattendLogWV" ??_C@_1BM@PPHHDPAK@?$AAU?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AAL?$AAo?$AAg?$AAW?$AAV?$AA?$AA@
0x14000C688: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x14000A94C: RtlpImageNtHeader
0x14000D520: "" ??_C@_13NOLLCAOD@?$AA?$AA?$AA?$AA@
0x14000D818: "Unknown reseal mode: %u" ??_C@_1DA@HPBAEHLE@?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?5?$AAr?$AAe?$AAs?$AAe?$AAa?$AAl?$AA?5?$AAm?$AAo?$AAd?$AAe?$AA?3?$AA?5?$AA?$CF?$AAu?$AA?$AA@
0x14001484C: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbrmhgUoryUlyquivUznwGEUhgwzucOlyq@pkeyinst" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbrmhgUoryUlyquivUznwGEUhgwzucOlyq@pkeyinst
0x140010258: "DllGetClassObject" ??_C@_0BC@JDLGBILA@DllGetClassObject?$AA@
0x14000D5A0: "API not available to notify UI l" ??_C@_1HK@NBCOPBNC@?$AAA?$AAP?$AAI?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAa?$AAv?$AAa?$AAi?$AAl?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAn?$AAo?$AAt?$AAi?$AAf?$AAy?$AA?5?$AAU?$AAI?$AA?5?$AAl@
0x14000ECC0: "GetAdminAccountName: Couldn't fi" ??_C@_1JI@DGDMCDFD@?$AAG?$AAe?$AAt?$AAA?$AAd?$AAm?$AAi?$AAn?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAN?$AAa?$AAm?$AAe?$AA?3?$AA?5?$AAC?$AAo?$AAu?$AAl?$AAd?$AAn?$AA?8?$AAt?$AA?5?$AAf?$AAi@
0x14000DC20: "WdsSetupLogDestroy" ??_C@_0BD@EHPFJNKD@WdsSetupLogDestroy?$AA@
0x140011B88: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x140011CB4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-lsapolicy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-lsapolicy-l1-1-0
0x14000E9F8: "AutoLogonCount" ??_C@_1BO@LDEMOFFD@?$AAA?$AAu?$AAt?$AAo?$AAL?$AAo?$AAg?$AAo?$AAn?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x14000C3B8: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x14000C5F0: "__cdecl _imp_LsaOpenPolicy" __imp_LsaOpenPolicy
0x140014000: PfnEventRegister
0x14000C208: "__cdecl _imp_UnattendCtxCleanup" __imp_UnattendCtxCleanup
0x140011910: ext-ms-win-ntuser-message-l1-1-0_NULL_THUNK_DATA_DLN
0x14000C5A0: "__cdecl _imp_ControlTraceW" __imp_ControlTraceW
0x140016058: ext-ms-win-ntuser-message-l1-1-0_NULL_THUNK_DATA_DLA
0x140011A28: ext-ms-win-ntuser-message-l1-1-0_NULL_THUNK_DATA_DLB
0x14000F1B0: "OOBE" ??_C@_19GNCDBIIN@?$AAO?$AAO?$AAB?$AAE?$AA?$AA@
0x14000CBE0: "Parsing command line arguments.." ??_C@_1EE@KDICIFLO@?$AAP?$AAa?$AAr?$AAs?$AAi?$AAn?$AAg?$AA?5?$AAc?$AAo?$AAm?$AAm?$AAa?$AAn?$AAd?$AA?5?$AAl?$AAi?$AAn?$AAe?$AA?5?$AAa?$AAr?$AAg?$AAu?$AAm?$AAe?$AAn?$AAt?$AAs?$AA?4?$AA?4@
0x14000C450: "__cdecl _imp_OpenThread" __imp_OpenThread
0x140011A40: ext-ms-win-rtcore-ntuser-sysparams-l1-1-0_NULL_THUNK_DATA_DLB
0x14000C598: api-ms-win-eventing-classicprovider-l1-1-0_NULL_THUNK_DATA
0x14000EFC0: "ScreenSaver:Was unable to determ" ??_C@_1IK@PLNDAPB@?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AAS?$AAa?$AAv?$AAe?$AAr?$AA?3?$AAW?$AAa?$AAs?$AA?5?$AAu?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAd?$AAe?$AAt?$AAe?$AAr?$AAm@
0x14000D3C0: "Failed to complete RunSMIPass fo" ??_C@_1GK@DAFBCCJI@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAo?$AAm?$AAp?$AAl?$AAe?$AAt?$AAe?$AA?5?$AAR?$AAu?$AAn?$AAS?$AAM?$AAI?$AAP?$AAa?$AAs?$AAs?$AA?5?$AAf?$AAo@
0x140010BF0: "Microsoft-Windows-Setup" ??_C@_1DA@IEAFNDGN@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?9?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?9?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x140010880: "EtwEventUnregister" ??_C@_0BD@JDHMJNFM@EtwEventUnregister?$AA@
0x14000D790: "Unable to construct full path to" ??_C@_1GC@CAMHFBEJ@?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAo?$AAn?$AAs?$AAt?$AAr?$AAu?$AAc?$AAt?$AA?5?$AAf?$AAu?$AAl?$AAl?$AA?5?$AAp?$AAa?$AAt?$AAh?$AA?5?$AAt?$AAo@
0x14000D920: "Failed to launch Sysprep with ar" ??_C@_1HA@CNKNKIMB@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAl?$AAa?$AAu?$AAn?$AAc?$AAh?$AA?5?$AAS?$AAy?$AAs?$AAp?$AAr?$AAe?$AAp?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAa?$AAr@
0x14000F730: "DeleteFileEx: Unable to get full" ??_C@_1HO@MMJLMIKH@?$AAD?$AAe?$AAl?$AAe?$AAt?$AAe?$AAF?$AAi?$AAl?$AAe?$AAE?$AAx?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe?$AAt?$AA?5?$AAf?$AAu?$AAl?$AAl@
0x14000C6B8: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x14000AEC8: "__cdecl _imp_load_NotifyUILanguageChange" __imp_load_NotifyUILanguageChange
0x14000F600: "GetForegroundWindow" ??_C@_0BE@IIKKNMMA@GetForegroundWindow?$AA@
0x14000CB48: "<empty>" ??_C@_1BA@BJHHGHEK@?$AA?$DM?$AAe?$AAm?$AAp?$AAt?$AAy?$AA?$DO?$AA?$AA@
0x14000C758: ntdll_NULL_THUNK_DATA
0x14000C6C0: "__cdecl _imp_memcpy" __imp_memcpy
0x140006F30: "long __cdecl RunSMIActionPass(struct _UNATTEND_CONTEXT const * __ptr64,unsigned short const * __ptr64,int,unsigned short const * __ptr64 * __ptr64,unsigned __int64,struct _UNATTEND_PROCESSING_RESULTS * __ptr64)" ?RunSMIActionPass@@YAJPEBU_UNATTEND_CONTEXT@@PEBGHPEAPEBG_KPEAU_UNATTEND_PROCESSING_RESULTS@@@Z
0x1400108E0: "EnableLocalUserAccount: Unable t" ??_C@_1IO@CJMMLDBC@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAL?$AAo?$AAc?$AAa?$AAl?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt@
0x14000D4D0: "%s has been requested for %s una" ??_C@_1EO@FDDLEFLC@?$AA?$CF?$AAs?$AA?5?$AAh?$AAa?$AAs?$AA?5?$AAb?$AAe?$AAe?$AAn?$AA?5?$AAr?$AAe?$AAq?$AAu?$AAe?$AAs?$AAt?$AAe?$AAd?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AA?$CF?$AAs?$AA?5?$AAu?$AAn?$AAa@
0x140007BC0: "long __cdecl GetSetActionQueueCookie(int,unsigned long * __ptr64)" ?GetSetActionQueueCookie@@YAJHPEAK@Z
0x14000AF54: "__cdecl Init_thread_footer" _Init_thread_footer
0x140010790: "Software\Microsoft\Windows\Curre" ??_C@_1IG@FMMIFIBP@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x14000CAC8: AuditProcessUnattendStopFailedToExecute
0x14000C990: "__cdecl _sz_ext_ms_win_ntuser_message_l1_1_0_dll" __sz_ext_ms_win_ntuser_message_l1_1_0_dll
0x14000C8F0: "__cdecl _sz_ext_ms_win_kernel32_localization_l1_1_0_dll" __sz_ext_ms_win_kernel32_localization_l1_1_0_dll
0x14000E5E8: "windowsPE" ??_C@_1BE@IBBOGJGJ@?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAP?$AAE?$AA?$AA@
0x14000DD10: "[%S] %S" ??_C@_07EKKPINLM@?$FL?$CFS?$FN?5?$CFS?$AA@
0x14000C5B8: "__cdecl _imp_GetSidSubAuthorityCount" __imp_GetSidSubAuthorityCount
0x14000CCF0: "Failed to disable the screensave" ??_C@_1GM@CDBCOHCE@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAd?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAs?$AAc?$AAr?$AAe?$AAe?$AAn?$AAs?$AAa?$AAv?$AAe@
0x14000C588: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x140011B60: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x14000DE80: "System\Setup\Status" ??_C@_1CI@EDJKIOEK@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?$AA@
0x14000E8C0: "DefaultDomainName" ??_C@_1CE@KHNBBMJ@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x140006130: DeleteFileEx2
0x14000F1C0: "Mode" ??_C@_19OBGHODPD@?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x14000C6D8: "__cdecl _imp___CxxFrameHandler3" __imp___CxxFrameHandler3
0x14000C590: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x14000C298: "__cdecl _imp_ApiSetQueryApiSetPresence" __imp_ApiSetQueryApiSetPresence
0x1400140D8: "__cdecl _security_cookie" __security_cookie
0x140010420: "Flush took %u ms." ??_C@_1CE@CLNCGACJ@?$AAF?$AAl?$AAu?$AAs?$AAh?$AA?5?$AAt?$AAo?$AAo?$AAk?$AA?5?$AA?$CF?$AAu?$AA?5?$AAm?$AAs?$AA?4?$AA?$AA@
0x14000C4B8: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x14000CF80: "Audit.exe is orchestrating a reb" ??_C@_1EO@KDMPMPJD@?$AAA?$AAu?$AAd?$AAi?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?5?$AAi?$AAs?$AA?5?$AAo?$AAr?$AAc?$AAh?$AAe?$AAs?$AAt?$AAr?$AAa?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAa?$AA?5?$AAr?$AAe?$AAb@
0x14000B390: "__cdecl alloca_probe" _alloca_probe
0x14000FB10: "Failed to apply data-only settin" ??_C@_1HA@DNONLKEL@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAa?$AAp?$AAp?$AAl?$AAy?$AA?5?$AAd?$AAa?$AAt?$AAa?$AA?9?$AAo?$AAn?$AAl?$AAy?$AA?5?$AAs?$AAe?$AAt?$AAt?$AAi?$AAn@
0x14000C458: "__cdecl _imp_GetExitCodeProcess" __imp_GetExitCodeProcess
0x14000F4A8: "unattend\settings[pass=%s]" ??_C@_1DG@FEEHCLI@?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?2?$AAs?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AA?$FL?$AAp?$AAa?$AAs?$AAs?$AA?$DN?$AA?$CF?$AAs?$AA?$FN?$AA?$AA@
0x140009050: RegDelete
0x14000CAD8: RunAuditStop
0x14000DFD0: "Deleting cached copy of unattend" ??_C@_1GA@PGGDLDME@?$AAD?$AAe?$AAl?$AAe?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAc?$AAa?$AAc?$AAh?$AAe?$AAd?$AA?5?$AAc?$AAo?$AAp?$AAy?$AA?5?$AAo?$AAf?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd@
0x14000C310: "__cdecl _imp_GetFullPathNameW" __imp_GetFullPathNameW
0x14000C368: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x140007930: "long __cdecl UnattendResultsFromSMIActionResults(struct IUnattendActionResultSet * __ptr64,struct _UNATTEND_PROCESSING_RESULTS * __ptr64)" ?UnattendResultsFromSMIActionResults@@YAJPEAUIUnattendActionResultSet@@PEAU_UNATTEND_PROCESSING_RESULTS@@@Z
0x14000FDF0: "Execution of unattend GCs failed" ??_C@_1IO@GGAMHLEP@?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAo?$AAf?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAG?$AAC?$AAs?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd@
0x140011C64: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-controller-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-controller-l1-1-0
0x140011A10: ext-ms-win-ntuser-keyboard-l1-1-0_NULL_THUNK_DATA_DLB
0x14000C398: "__cdecl _imp_LocalFree" __imp_LocalFree
0x14000CAB8: AuditProcessUnattendStart
0x14000C5B0: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x1400140D0: "__cdecl _defaultmatherr" __defaultmatherr
0x140011AD4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x140001370: McGenControlCallbackV2
0x14000C2C0: api-ms-win-core-com-l1-1-0_NULL_THUNK_DATA
0x14000C7E8: "__cdecl _xl_a" __xl_a
0x14000C3E8: "__cdecl _imp_LoadLibraryW" __imp_LoadLibraryW
0x14000C870: "__cdecl _sz_api_ms_win_shcore_obsolete_l1_1_0_dll" __sz_api_ms_win_shcore_obsolete_l1_1_0_dll
0x14000C348: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x140010B10: "RestoreLocalUserAccountState: Un" ??_C@_1LM@GEDGEADN@?$AAR?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AAL?$AAo?$AAc?$AAa?$AAl?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?3?$AA?5?$AAU?$AAn@
0x14000FB80: "Calling into RunSMIActionPass to" ??_C@_1II@NCDOCIGN@?$AAC?$AAa?$AAl?$AAl?$AAi?$AAn?$AAg?$AA?5?$AAi?$AAn?$AAt?$AAo?$AA?5?$AAR?$AAu?$AAn?$AAS?$AAM?$AAI?$AAA?$AAc?$AAt?$AAi?$AAo?$AAn?$AAP?$AAa?$AAs?$AAs?$AA?5?$AAt?$AAo@
0x14000CA80: "EventRegister" ??_C@_0O@BAMBGLIE@EventRegister?$AA@
0x14000E628: "generalize" ??_C@_1BG@NDGGEKGG@?$AAg?$AAe?$AAn?$AAe?$AAr?$AAa?$AAl?$AAi?$AAz?$AAe?$AA?$AA@
0x14000C478: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x1400148D0: "__cdecl _onexitbegin" __onexitbegin
0x14000B179: "__cdecl _imp_load_GetMessageW" __imp_load_GetMessageW
0x14000E340: "Couldn't form canonical path nam" ??_C@_1IG@EDHBMOJC@?$AAC?$AAo?$AAu?$AAl?$AAd?$AAn?$AA?8?$AAt?$AA?5?$AAf?$AAo?$AAr?$AAm?$AA?5?$AAc?$AAa?$AAn?$AAo?$AAn?$AAi?$AAc?$AAa?$AAl?$AA?5?$AAp?$AAa?$AAt?$AAh?$AA?5?$AAn?$AAa?$AAm@
0x14000D9F0: "Explicit unattend was requested:" ??_C@_1EM@LJKGJMCD@?$AAE?$AAx?$AAp?$AAl?$AAi?$AAc?$AAi?$AAt?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAw?$AAa?$AAs?$AA?5?$AAr?$AAe?$AAq?$AAu?$AAe?$AAs?$AAt?$AAe?$AAd?$AA?3@
0x14000B167: "__cdecl _imp_load_UnregisterHotKey" __imp_load_UnregisterHotKey
0x14000CF30: "Failed to orchestrate reboot; hr" ??_C@_1FA@KPHMKCBB@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAo?$AAr?$AAc?$AAh?$AAe?$AAs?$AAt?$AAr?$AAa?$AAt?$AAe?$AA?5?$AAr?$AAe?$AAb?$AAo?$AAo?$AAt?$AA?$DL?$AA?5?$AAh?$AAr@
0x140010840: "State.ini" ??_C@_1BE@HGIGAEMF@?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?4?$AAi?$AAn?$AAi?$AA?$AA@
0x14000C6E8: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x14000C2F0: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140010290: "/settings/component/" ??_C@_1CK@OKOGPBF@?$AA?1?$AAs?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AA?1?$AAc?$AAo?$AAm?$AAp?$AAo?$AAn?$AAe?$AAn?$AAt?$AA?1?$AA?$AA@
0x14000D860: "/reboot" ??_C@_1BA@PAEHCIAD@?$AA?1?$AAr?$AAe?$AAb?$AAo?$AAo?$AAt?$AA?$AA@
0x14000C498: "__cdecl _imp_RegDeleteTreeW" __imp_RegDeleteTreeW
0x14000AFC4: "__cdecl Init_thread_header" _Init_thread_header
0x140014830: g_WdsLibLog
0x14000C400: api-ms-win-core-privateprofile-l1-1-0_NULL_THUNK_DATA
0x140005D54: MsgBoxStrV
0x140014060: Microsoft_Windows_Deplorch_Context
0x14000D870: "/Generalize" ??_C@_1BI@ENNCFGNG@?$AA?1?$AAG?$AAe?$AAn?$AAe?$AAr?$AAa?$AAl?$AAi?$AAz?$AAe?$AA?$AA@
0x14000C4A0: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x14000F540: "*SENSITIVE*DATA*DELETED*" ??_C@_1DC@HBPJBHJK@?$AA?$CK?$AAS?$AAE?$AAN?$AAS?$AAI?$AAT?$AAI?$AAV?$AAE?$AA?$CK?$AAD?$AAA?$AAT?$AAA?$AA?$CK?$AAD?$AAE?$AAL?$AAE?$AAT?$AAE?$AAD?$AA?$CK?$AA?$AA@
0x140010A50: "RestoreLocalUserAccountState: Un" ??_C@_1LK@JLJALJJJ@?$AAR?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AAL?$AAo?$AAc?$AAa?$AAl?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?3?$AA?5?$AAU?$AAn@
0x14000E8F0: "SOFTWARE\Microsoft\Windows NT\Cu" ??_C@_1GM@GIBHDOLK@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x14000AAF4: "__cdecl _security_init_cookie" __security_init_cookie
0x1400108A8: "EtwEventWrite" ??_C@_0O@MJPOMPOC@EtwEventWrite?$AA@
0x14000C650: "__cdecl _imp__cexit" __imp__cexit
0x140010340: "CreatePath: Unable to create par" ??_C@_1IG@HCLNMHAA@?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAr?$AAe?$AAa?$AAt?$AAe?$AA?5?$AAp?$AAa?$AAr@
0x1400101D0: "%windir%\panther\actionqueue" ??_C@_1DK@BAPADGKM@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAp?$AAa?$AAn?$AAt?$AAh?$AAe?$AAr?$AA?2?$AAa?$AAc?$AAt?$AAi?$AAo?$AAn?$AAq?$AAu?$AAe?$AAu?$AAe?$AA?$AA@
0x1400031E4: UnattendLogW
0x140005FB4: LibLog
0x14000A9A8: "__cdecl get_image_app_type" _get_image_app_type
0x14000F690: "DeleteFileEx: Unable to allocate" ??_C@_1JG@NHOALAOF@?$AAD?$AAe?$AAl?$AAe?$AAt?$AAe?$AAF?$AAi?$AAl?$AAe?$AAE?$AAx?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAa?$AAl?$AAl?$AAo?$AAc?$AAa?$AAt?$AAe@
0x140007574: "long __cdecl ApplySMISettings(struct ISettingsEngine * __ptr64,struct ISettingsContext * __ptr64,struct ITargetInfo * __ptr64,unsigned short const * __ptr64 * __ptr64 * __ptr64,unsigned __int64 * __ptr64,struct _UNATTEND_PROCESSING_RESULTS * __ptr64)" ?ApplySMISettings@@YAJPEAUISettingsEngine@@PEAUISettingsContext@@PEAUITargetInfo@@PEAPEAPEBGPEA_KPEAU_UNATTEND_PROCESSING_RESULTS@@@Z
0x140011A48: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x14000B34E: wcscmp
0x14000E640: "specialize" ??_C@_1BG@GKLAPFBG@?$AAs?$AAp?$AAe?$AAc?$AAi?$AAa?$AAl?$AAi?$AAz?$AAe?$AA?$AA@
0x140016040: ext-ms-win-ntuser-keyboard-l1-1-0_NULL_THUNK_DATA_DLA
0x14000C228: "__cdecl _imp_UnattendMarkPassUsedInCtx" __imp_UnattendMarkPassUsedInCtx
0x14000E9A8: "AutoAdminLogon" ??_C@_1BO@IKBCMOPJ@?$AAA?$AAu?$AAt?$AAo?$AAA?$AAd?$AAm?$AAi?$AAn?$AAL?$AAo?$AAg?$AAo?$AAn?$AA?$AA@
0x14000D8B0: "Successfully launched Sysprep wi" ??_C@_1GK@BAEBPDFM@?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAl?$AAy?$AA?5?$AAl?$AAa?$AAu?$AAn?$AAc?$AAh?$AAe?$AAd?$AA?5?$AAS?$AAy?$AAs?$AAp?$AAr?$AAe?$AAp?$AA?5?$AAw?$AAi@
0x1400118E0: ext-ms-win-kernel32-localization-l1-1-0_NULL_THUNK_DATA_DLN
0x140014890: "private: static class CEtwProviderT<void> CChkMacroETWLoggerT<class CEmptyType>::g_chkMacroETWProvider" ?g_chkMacroETWProvider@?$CChkMacroETWLoggerT@VCEmptyType@@@@0V?$CEtwProviderT@X@@A
0x14000E3D0: "Error expanding Unattend source " ??_C@_1FE@OHFPOIHC@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAe?$AAx?$AAp?$AAa?$AAn?$AAd?$AAi?$AAn?$AAg?$AA?5?$AAU?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5@
0x14000320C: UnattendLogWV
0x1400081D4: StrDupe
0x140016048: "__cdecl _imp_PostThreadMessageW" __imp_PostThreadMessageW
0x140010510: "IMAGE_STATE_GENERALIZE_RESEAL_TO" ??_C@_1EM@POLMGCN@?$AAI?$AAM?$AAA?$AAG?$AAE?$AA_?$AAS?$AAT?$AAA?$AAT?$AAE?$AA_?$AAG?$AAE?$AAN?$AAE?$AAR?$AAA?$AAL?$AAI?$AAZ?$AAE?$AA_?$AAR?$AAE?$AAS?$AAE?$AAA?$AAL?$AA_?$AAT?$AAO@
0x14000D6A0: "Failed to arrange for [%s] to be" ??_C@_1HO@BHCGAHIA@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAa?$AAr?$AAr?$AAa?$AAn?$AAg?$AAe?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?5?$AAt?$AAo?$AA?5?$AAb?$AAe@
0x1400083F0: WdsExecuteApplication
0x14000CB08: RunAuditStart
0x140004454: "long __cdecl OrchestrateAutoLogon(unsigned short const * __ptr64)" ?OrchestrateAutoLogon@@YAJPEBG@Z
0x14000C730: "__cdecl _imp_NtSetInformationFile" __imp_NtSetInformationFile
0x140002BD4: McTemplateMofU0zz
0x1400065BC: DirectoryExists
0x14000AC40: "__cdecl _report_gsfailure" __report_gsfailure
0x14000C2A0: api-ms-win-core-apiquery-l1-1-0_NULL_THUNK_DATA
0x14000C570: "__cdecl _imp_TraceEvent" __imp_TraceEvent
0x14000C4E8: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x14000A810: "__cdecl onexit" _onexit
0x14000DEB0: "System\Setup\Status\AuditBootVol" ??_C@_1EM@EIPHPJDH@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?2?$AAA?$AAu?$AAd?$AAi?$AAt?$AAB?$AAo?$AAo?$AAt?$AAV?$AAo?$AAl@
0x14000FD90: "Successfully completed execution" ??_C@_1FK@LFPGCPLA@?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAl?$AAy?$AA?5?$AAc?$AAo?$AAm?$AAp?$AAl?$AAe?$AAt?$AAe?$AAd?$AA?5?$AAe?$AAx?$AAe?$AAc?$AAu?$AAt?$AAi?$AAo?$AAn@
0x14000CD60: "Successfully ran unattend pass." ??_C@_1EA@HJCBGKFJ@?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAl?$AAy?$AA?5?$AAr?$AAa?$AAn?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAp?$AAa?$AAs?$AAs?$AA?4?$AA?$AA@
0x1400148C0: "__cdecl _native_startup_state" __native_startup_state
0x14000F628: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x140003AE0: "int __cdecl OrchestrateIsValidPass(unsigned short const * __ptr64)" ?OrchestrateIsValidPass@@YAHPEBG@Z
0x140002D98: McTemplateMofU0z
0x14000EE90: "ScreenSaver:Screen saver was ori" ??_C@_1JG@NOOLIBIM@?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AAS?$AAa?$AAv?$AAe?$AAr?$AA?3?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?5?$AAs?$AAa?$AAv?$AAe?$AAr?$AA?5?$AAw?$AAa?$AAs?$AA?5?$AAo?$AAr?$AAi@
0x14000E2F0: "Couldn't copy file from [%s] to " ??_C@_1EK@JNNFGBKE@?$AAC?$AAo?$AAu?$AAl?$AAd?$AAn?$AA?8?$AAt?$AA?5?$AAc?$AAo?$AAp?$AAy?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?5?$AAf?$AAr?$AAo?$AAm?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?5?$AAt?$AAo?$AA?5@
0x14000DA50: "/user" ??_C@_1M@EFDPFDEI@?$AA?1?$AAu?$AAs?$AAe?$AAr?$AA?$AA@
0x140001200: McGenControlCallback
0x1400103E0: "Flushing registry to disk..." ??_C@_1DK@CFBBJAAP@?$AAF?$AAl?$AAu?$AAs?$AAh?$AAi?$AAn?$AAg?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAt?$AAo?$AA?5?$AAd?$AAi?$AAs?$AAk?$AA?4?$AA?4?$AA?4?$AA?$AA@
0x14000C630: "__cdecl _imp__fmode" __imp__fmode
0x140014808: g_FindNextFileName
0x1400146F0: "__cdecl _hmod__ext_ms_win_ntuser_message_l1_1_0_dll" __hmod__ext_ms_win_ntuser_message_l1_1_0_dll
0x140016068: ext-ms-win-rtcore-ntuser-sysparams-l1-1-0_NULL_THUNK_DATA_DLA
0x14000D310: "Cached unattend file, returned: " ??_C@_1EK@LOKFBDMB@?$AAC?$AAa?$AAc?$AAh?$AAe?$AAd?$AA?5?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?0?$AA?5?$AAr?$AAe?$AAt?$AAu?$AAr?$AAn?$AAe?$AAd?$AA?3?$AA?5@
0x14000DBD0: "auditSystem" ??_C@_1BI@JGFACJDA@?$AAa?$AAu?$AAd?$AAi?$AAt?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?$AA@
0x14000C1F8: "__cdecl _imp_SysFreeString" __imp_SysFreeString
0x140011B24: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x140010C20: "PersistLogSession" ??_C@_1CE@DBBAKPHK@?$AAP?$AAe?$AAr?$AAs?$AAi?$AAs?$AAt?$AAL?$AAo?$AAg?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x14000CE20: "There was an error while process" ??_C@_1IK@ONBANBFM@?$AAT?$AAh?$AAe?$AAr?$AAe?$AA?5?$AAw?$AAa?$AAs?$AA?5?$AAa?$AAn?$AA?5?$AAe?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAw?$AAh?$AAi?$AAl?$AAe?$AA?5?$AAp?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs@
0x14000AA60: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x14000C540: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x1400105D0: "IMAGE_STATE_SPECIALIZE_RESEAL_TO" ??_C@_1EM@BOCJCCJM@?$AAI?$AAM?$AAA?$AAG?$AAE?$AA_?$AAS?$AAT?$AAA?$AAT?$AAE?$AA_?$AAS?$AAP?$AAE?$AAC?$AAI?$AAA?$AAL?$AAI?$AAZ?$AAE?$AA_?$AAR?$AAE?$AAS?$AAE?$AAA?$AAL?$AA_?$AAT?$AAO@
0x140011CC8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-privateprofile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-privateprofile-l1-1-0
0x14000F970: "Current pass status for [%s] is " ??_C@_1EO@JBIGMGJD@?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AA?5?$AAp?$AAa?$AAs?$AAs?$AA?5?$AAs?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?5?$AAi?$AAs?$AA?5@
0x1400146E8: "__cdecl _hmod__ext_ms_win_ntuser_keyboard_l1_1_0_dll" __hmod__ext_ms_win_ntuser_keyboard_l1_1_0_dll
0x14000C330: "__cdecl _imp_SetFileAttributesW" __imp_SetFileAttributesW
0x140003954: "long __cdecl OrchestrateSetCompletionStatus(unsigned short const * __ptr64,enum _COMPLETION_STATUS)" ?OrchestrateSetCompletionStatus@@YAJPEBGW4_COMPLETION_STATUS@@@Z
0x14000CAF8: Microsoft_Windows_AuditKeywords
0x14000C520: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x140011AFC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x140004B40: "long __cdecl OrchestrateClearAutoLogonIfSetByOrch(void)" ?OrchestrateClearAutoLogonIfSetByOrch@@YAJXZ
0x14000B342: memset
0x140011CDC: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x14000E790: "System\Setup\Status\SysprepStatu" ??_C@_1EE@LGFDLBMC@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?2?$AAS?$AAy?$AAs?$AAp?$AAr?$AAe?$AAp?$AAS?$AAt?$AAa?$AAt?$AAu@
0x140004204: "long __cdecl EnableShiftF10(unsigned long * __ptr64)" ?EnableShiftF10@@YAJPEAK@Z

[JEB Decompiler by PNF Software]